# Homomorphic mapping between elliptic curve point and Zq

I'm trying to figure out how to do a mapping between elliptic curve points and Zq without breaking homomorphic properties.

Sorry, I'll write the problem in multiplicative notation because it's easier.

I've got $$a = g^bh^r \in \mathbb{G}_1$$, where $$g$$ is a generator of $$\mathbb{G}_1$$, $$h = g^s$$ and $$r, s, b$$ are some values from $$Z_q$$. I need to have a Pedersen commitment to $$g^b$$, but since $$g^b\in \mathbb{G}_1$$ I should map it to $$Z_q$$ with function $$F$$ first i.e. $$c = G^{F(g^b)}H^R$$, where $$G,H \in \mathbb{G}_1$$ is a commitment key and $$R$$ is randomly selected from $$Z_q$$.

The point is, I need to relate $$a$$ and $$c$$, so I need to find a mapping function F such that $$G^{F(a)} = G^{F(g^b) \cdot F(h^r)}$$.

Do you have any idea how to chose $$F$$ if $$\mathbb{G}_1$$ is an elliptic curve? Or if it's even possible? In the finite fields, $$\bmod q$$ would have worked ($$q$$ is prime). But with points, I'm not sure what to do. Maybe homomorphic hash functions would work, not sure.

• @kelalaka, homomorphic. Thanks, fixed! – pintor Feb 21 at 10:25
• When you say $x = y \cdot h^r$ what is $h$ what is $r$ what is $y$, EC has coordinates $(x,y)$ is it $x$ or $y$? – kelalaka Feb 21 at 10:31
• @kelalaka. Maybe I used not the best notations, y and x are not related to EC coordinates. It's just some points on G1. I'll update notations – pintor Feb 21 at 10:36
• if you consider scalar multiplication on ECC write as $[k]P$ and if you extract the $x$ coordinate then $x(P)$. – kelalaka Feb 21 at 10:41
• also, unless $q$ is prime, mod $q$ won’t work – kodlu Feb 21 at 23:20

I think that you can use a bilinear pairing map for the function $$F$$. This map is defined from $$G_1 \times G_2$$ to $$\mu_n$$. This means that $$F(x)=e(x,T)$$ that $$T \in G_2$$.

The feature of this map is as:

$$e(g^a,T^b)=e(g,T)^{ab}$$

$$e(g^bh^r,T)=e(g^b,T).e(h^r,T)=F(g^b).F(h^r)$$

• but aren't \mu_n a cyclic group too? – pintor Feb 25 at 14:03
• $\mu_n$ is a cyclic group. – mehdi mahdavi oliaiy Feb 25 at 19:33
• Thanks, but I need a mapping to $Z_q$. So one more step in F is missing - map $\mu_n$ to $Z_q$. Do we know anything about $\mu_n$? Can it be any cyclic group of order q, for example, a subgroup of $Z^*_p$? Btw, it's type-3 pairing, right? – pintor Feb 26 at 13:51
• Or $\mu_n$ is a group of $n$-th roots of unity in $F^∗_{p^n}$? – pintor Feb 26 at 14:14
• Sorry, I cannot accept the answer as it is, because it's incomplete. Can you please edit it before bounty expires? Thanks! – pintor 16 hours ago